---
typeId: req
recordId: benac-exec-007
fields:
  title: Host-mediated package APIs
  statement: >-
    Package operations shall interact with host resources only through defined host
    imports or equivalent mediated calls.

    Mediated calls shall include blob access, HTTPS fetch, storage use, compute use,
    secret use, encryption/decryption, evidence emission, effect request, clock, random
    bytes, output return, package invocation, authentication-context reporting, and
    capability introspection when those calls are declared and granted.

    A package shall not receive raw host authority by declaring a mediated call.

    A Station shall expose a mediated call to a package operation only when Local Policy
    grants the required capability for the relevant operation phase.

    A Station shall record denied calls, failed calls, completed calls, and raw
    diagnostic evidence disposition where practical and safe.
  rationale: >-
    The Station must remain the enforcement and evidence chokepoint.
  verification: >-
    Package-host conformance tests verify authorized mediated calls, denied calls, input
    encoding, output encoding, memory behavior where relevant, error behavior, and
    evidence/effect recording.
  testable: true
  status: draft
  area: BENAC-EXEC
  sourceDocument: user-requested schema-first requirements cleanup
  sourceVersion: 2026-05-06
  sourceSections:
    - Execution model and package host interface
  order: 104
---
